Install and verify

Before you can protect anything, you need a CLI you can trust. This page takes you from the public download mirror to a verified trustplane --help, then shows you how to pin the container images, Helm chart, and SDKs that go with it.

If you want the short story of what TrustPlane Auth protects before installing anything, read What is TrustPlane Auth? first.

What you will install

Artifact	What to use	Pinning rule
CLI	`trustplane` archive from the public downloads mirror	Verify `SHA256SUMS` before unpacking or running it.
Adapter image	GHCR `trustplane-auth-adapter` image	Use the documented version tag plus digest.
Helm chart	`oci://ghcr.io/trustplane-dev/charts/trustplane-auth`	Use chart version `0.2.2` and digest-pinned images.
Go SDK	`github.com/trustplane-dev/trustplane-auth-sdk-go` module	Pin `v0.2.3` explicitly.
TypeScript SDK	npm package `@trustplane/auth-sdk`	Pin `0.2.3` explicitly. Node.js-only.
Python SDK	PyPI distribution `trustplane-auth-sdk`	Pin `0.2.3` explicitly. Caller-side only.

Do not use a mutable latest tag or unpinned chart version.

Choose your CLI archive

The v0.2.5 public downloads base is:

https://downloads.auth.trustplane.dev/trustplane/v0.2.5/

Archive names use this pattern (the release-manifest.json in the same directory lists the full archive set with per-archive SHA-256 values):

trustplane_v0.2.5_<os>_<arch>.tar.gz

Use the archive that matches your machine:

Platform	Archive guidance
macOS Apple Silicon	`trustplane_v0.2.5_darwin_arm64.tar.gz`
macOS Intel	`trustplane_v0.2.5_darwin_amd64.tar.gz`
Linux x86_64	`trustplane_v0.2.5_linux_amd64.tar.gz`
Linux arm64	`trustplane_v0.2.5_linux_arm64.tar.gz`

The current release does not include Windows artifacts.

Download the checksums and your archive

Set the archive name first, then download SHA256SUMS and the matching archive:

VERSION=v0.2.5
BASE_URL="https://downloads.auth.trustplane.dev/trustplane/${VERSION}"
ARCHIVE="trustplane_${VERSION}_darwin_arm64.tar.gz"

curl -fsSLO "${BASE_URL}/SHA256SUMS"
curl -fsSLO "${BASE_URL}/${ARCHIVE}"

Replace ARCHIVE with the macOS or Linux file from the table above.

Verify the checksum before install or use

Verify the archive checksum before unpacking or running anything from the archive:

grep "  ${ARCHIVE}$" SHA256SUMS | shasum -a 256 -c -

On Linux, sha256sum is also fine:

grep "  ${ARCHIVE}$" SHA256SUMS | sha256sum -c -

If the checksum does not match, stop and download the files again.

Unpack and verify the CLI starts

For macOS and Linux:

tar -xzf "$ARCHIVE"
./trustplane --help

If macOS blocks the extracted CLI because the download is quarantined, first confirm the archive checksum passed, then clear quarantine on that CLI file only and retry:

xattr -d com.apple.quarantine ./trustplane
./trustplane --help

Run this only for the verified archive you chose. Do not disable Gatekeeper for the machine.

trustplane --help is the first local verification point. It confirms that the checked archive contains a runnable TrustPlane Auth CLI for your platform. The v0.2.5 mirror manifest says github_artifact_attestations_unavailable: GitHub does not provide artifact attestations for this repository. Verify SHA256SUMS before use and read the release notes.

Pin the images and chart

The adapter image is a public GHCR artifact and should be referenced by version tag plus digest. The Helm chart is available at:

oci://ghcr.io/trustplane-dev/charts/trustplane-auth

Use chart version:

0.2.2

Keep the chart version pinned and keep image references digest-pinned. The exact image digests, chart commands, and release-channel details live in Install and artifacts.

Install an SDK

The SDK modules are caller-side: they sign proof-bound requests, enroll workload keys through TA-G1 public auto-enrollment, and speak broker IPC v1 from caller code, returning adapter-ready TrustPlane headers. They are not verifiers, Control admin API clients, gateway plugins, broker runtimes, or policy distribution paths.

go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.3
npm install @trustplane/auth-sdk@0.2.3

The TypeScript SDK is Node.js-only in the current release. The Python SDK is also released (python -m pip install trustplane-auth-sdk==0.2.3). See Go SDK, TypeScript SDK, Python SDK, and SDK contract for scope and conformance notes.

Next steps

With a verified CLI in hand, you can start putting TrustPlane Auth to work:

Choose the local or managed starting path, then run the first local protected request.
Walk through Protect your first API when you are ready to put the adapter in front of an existing service.
Browse the use cases overview to understand same-cluster SPIFFE, software/JWKS, and cross-environment caller patterns.
Put the adapter directly in front of an API endpoint. Existing gateways such as Envoy, NGINX, and Kong are relevant integration targets, but gateway-specific templates are adoption accelerators, not required for the core verifier model. See Gateway integration patterns for the current adapter-routing shape.
Use the route policy map to understand which source rules can call which routes.

For what the current release covers and what is planned, see Scope.